OSVauco/opax-web

OPAX Web TUI

This project provides a starter scaffold for a Google-login-gated web control plane. It consists of a React frontend and a Node.js backend.

The frontend provides a terminal-like interface for interacting with the system. The backend handles user authentication via Google OAuth2 and provides a secure boundary for potential agent integrations.

Local Development

To run the application locally, first install the dependencies:

npm install

Then, start the development server:

npm run dev

Configuration

The backend requires several environment variables for configuration. For local development, you can create a .env file in the opax-web/backend/ directory.

• Do not commit .env files to Git.
• NEVER use or copy production secrets into a local .env file.
• For configuration that requires secrets, use local, rotatable test values.
• Production secrets must be stored and delivered via the dedicated secrets solution described in SECURITY.md.

Required configuration keys:

• FRONTEND_URL
• ALLOWED_EMAILS
• GOOGLE_CLIENT_ID
• GOOGLE_CLIENT_SECRET
• SESSION_SECRET

Note: The outbound agent integration is currently disabled by default (fail-closed). The backend will not attempt to connect to any external agent services.

Security

IMPORTANT: Never commit passwords, tokens, OAuth client secrets, or service account keys to the Git repository. If any credential is accidentally exposed, it MUST be revoked and rotated immediately.

For more details, see SECURITY.md.